C05 — Quyền riêng tư dữ liệu

# PII Data Discovery — tìm dữ liệu cá nhân trong file system
# Phục vụ data mapping và DPIA requirements

$scanPath  = "C:\DataScan"
$fileTypes = @("*.txt", "*.csv", "*.log", "*.json")
$report    = @()

# PII Pattern definitions
$patterns = @{
    "CCCD/CMND VN"  = '\b\d{9}(\d{3})?\b'           # 9 or 12 digits
    "Email Address"  = '[a-zA-Z0-9._%+\-]+@[a-zA-Z0-9.\-]+\.[a-zA-Z]{2,}'
    "Phone VN"       = '\b(0|\+84)[3-9]\d{8}\b'
    "Credit Card"    = '\b(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14}|3[47][0-9]{13})\b'
    "Date of Birth"  = '\b(0[1-9]|[12]\d|3[01])[\/\-](0[1-9]|1[0-2])[\/\-](19|20)\d{2}\b'
    "IP Address"     = '\b(?:\d{1,3}\.){3}\d{1,3}\b'
}

# Scan files
foreach ($ext in $fileTypes) {
    Get-ChildItem -Path $scanPath -Filter $ext -Recurse -ErrorAction SilentlyContinue |
    ForEach-Object {
        $file    = $_
        $content = Get-Content $file.FullName -Raw -ErrorAction SilentlyContinue
        if (-not $content) { return }

        foreach ($piiType in $patterns.Keys) {
            $matches = [regex]::Matches($content, $patterns[$piiType])
            if ($matches.Count -gt 0) {
                $report += [PSCustomObject]@{
                    File       = $file.FullName
                    PIIType    = $piiType
                    Count      = $matches.Count
                    SizeMB     = [math]::Round($file.Length / 1MB, 2)
                    LastWrite  = $file.LastWriteTime.ToString("yyyy-MM-dd")
                    Risk       = switch ($piiType) {
                        "Credit Card" { "CRITICAL" }
                        "CCCD/CMND VN" { "HIGH" }
                        "Date of Birth" { "HIGH" }
                        default { "MEDIUM" }
                    }
                }
            }
        }
    }
}

$report | Sort-Object Risk, PIIType | Format-Table -AutoSize
$report | Export-Csv "C:\GRC\pii-discovery-report.csv" -NoTypeInformation -Encoding UTF8

# Risk summary
Write-Host "`nPII Discovery Summary:" -ForegroundColor Yellow
$report | Group-Object Risk | Select-Object @{N="Risk";E={$_.Name}}, Count | Format-Table

File                           PIIType        Count  SizeMB  LastWrite   Risk
----                           -------        -----  ------  ---------   ----
C:\DataScan\orders-2025.csv    Credit Card    234    2.4     2025-12-31  CRITICAL
C:\DataScan\customers.csv      CCCD/CMND VN   891    5.1     2026-01-15  HIGH
C:\DataScan\employees.csv      Date of Birth  156    0.8     2026-03-20  HIGH
C:\DataScan\crm-export.csv     Email Address  1247   8.2     2026-05-10  MEDIUM
C:\DataScan\access.log         IP Address     3421   12.6    2026-05-24  MEDIUM

PII Discovery Summary:
Risk      Count
----      -----
CRITICAL  1
HIGH      2
MEDIUM    2

Action required: Immediate remediation for CRITICAL finding (Credit Card in CSV)

ISO/IEC 27701:2019 — Privacy Extension (PIMS)

DPIA vs PIA — Phân biệt quan trọng

Frameworks Quốc tế — PDPA Singapore & DPF EU-US